robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ITHC: enforce container ownership on uploads

Browse Source
This commit is contained in:
robbond
2026-10-27 06:05:47 +00:00
parent 5e98d6e8c2
commit 65616f6307
4 changed files with 381 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pages/api/file/upload.js
+40 -9
View File
@@ -1,6 +1,7 @@
import { createBlob, createRepBlob } from "../../../actions/azurestorage";
import { hashAPIPath } from "../../../actions/core/hash";
import { respondError, respondSuccess } from "../middleware/apiResponse";
import { getSession } from "next-auth/react";
import nextConnect from "next-connect";
import middleware from "../middleware/middleware";
@@ -8,9 +9,48 @@ import middleware from "../middleware/middleware";
const ApiProxy = nextConnect();
ApiProxy.use(middleware);
const unauthenticated = (res) =>
respondError(res, {
status: 401,
code: "UNAUTHENTICATED",
message: "Authentication required"
});
const forbidden = (res) =>
respondError(res, {
status: 403,
code: "FORBIDDEN",
message: "Request not permitted"
});
ApiProxy.post(async (req, res) => {
const getFieldValue = (field) => (Array.isArray(field) ? field[0] : field);
const session = await getSession({ req });
if (
typeof session?.user?.id !== "string" ||
session.user.id.length === 0
) {
return unauthenticated(res);
}
const appealData = getFieldValue(req.body?.appealData);
const containerID = getFieldValue(req.body?.containerID);
const casefolderID = getFieldValue(req.body?.casefolderID);
const repOrAppealRaw = getFieldValue(req.body?.repOrAppeal);
const repOrAppeal =
repOrAppealRaw === true ||
repOrAppealRaw === "true" ||
repOrAppealRaw === "1";
if (
typeof containerID !== "undefined" &&
containerID.length > 0 &&
session.user.id !== containerID
) {
return forbidden(res);
}
const checkHash = req.query.hash;
if (typeof checkHash === "undefined" || checkHash.length === 0) {
@@ -34,15 +74,6 @@ ApiProxy.post(async (req, res) => {
});
}
const appealData = getFieldValue(req.body?.appealData);
const containerID = getFieldValue(req.body?.containerID);
const casefolderID = getFieldValue(req.body?.casefolderID);
const repOrAppealRaw = getFieldValue(req.body?.repOrAppeal);
const repOrAppeal =
repOrAppealRaw === true ||
repOrAppealRaw === "true" ||
repOrAppealRaw === "1";
if (
typeof containerID === "undefined" ||
containerID.length === 0 ||
pages/api/file/uploadsinglefile.js
+34 -3
View File
@@ -6,6 +6,7 @@ import { consoleLogger } from "../../../actions/core/logger";
import { hashAPIPath } from "../../../actions/core/hash";
import { respondError, respondSuccess } from "../middleware/apiResponse";
import { fileTypeFromBuffer } from "file-type";
import { getSession } from "next-auth/react";
import fs from "fs";
import path from "path";
@@ -36,7 +37,40 @@ function validateFilenameServer(originalFilename) {
const ApiProxy = nextConnect();
ApiProxy.use(middleware);
const unauthenticated = (res) =>
respondError(res, {
status: 401,
code: "UNAUTHENTICATED",
message: "Authentication required"
});
const forbidden = (res) =>
respondError(res, {
status: 403,
code: "FORBIDDEN",
message: "Request not permitted"
});
ApiProxy.post(async (req, res) => {
const session = await getSession({ req });
if (
typeof session?.user?.id !== "string" ||
session.user.id.length === 0
) {
return unauthenticated(res);
}
const containerID = req.body?.containerID?.[0];
const casefolderID = req.body?.casefolderID?.[0];
if (
typeof containerID !== "undefined" &&
containerID.length > 0 &&
session.user.id !== containerID
) {
return forbidden(res);
}
const checkHash = req.query.hash;
if (typeof checkHash === "undefined" || checkHash.length === 0) {
@@ -63,9 +97,6 @@ ApiProxy.post(async (req, res) => {
});
}
const containerID = req.body?.containerID?.[0];
const casefolderID = req.body?.casefolderID?.[0];
if (
typeof containerID === "undefined" ||
containerID.length === 0 ||